EUVD-2025-16875Severity by source
AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionCVE.org
Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect 16 (Windows) before build 39938.
AnalysisAI
Local privilege escalation vulnerability in Acronis Cyber Protect 16 (Windows) caused by insecure folder permissions (CWE-732), allowing authenticated local users to escalate privileges with high confidentiality, integrity, and availability impact. The vulnerability affects Windows installations before build 39938, and while the CVSS score of 7.3 indicates significant risk, exploitation requires local access and user interaction. No public indicators confirm active exploitation in the wild or widespread POC availability at this time.
Technical ContextAI
The vulnerability stems from improper access control on application folders (CWE-732: Incorrect Permission Assignment for Critical Resource), a common Windows privilege escalation pattern where overly permissive DACL (Discretionary Access Control List) settings allow non-privileged local users to modify or replace executable files or configuration data used by higher-privileged processes. Acronis Cyber Protect 16 (CPE: cpe:2.3:a:acronis:cyber_protect:16:*:*:*:*:windows:*:*) for Windows installations before build 39938 contains this flaw in its folder permission model. The root cause is likely insufficient restriction on directories containing executable code, libraries, or security-critical configuration files that are executed or loaded with elevated privileges.
RemediationAI
Update Acronis Cyber Protect 16 (Windows) to build 39938 or later. Check the Acronis security advisory (https://www.acronis.com/en-us/support/security-advisories/) for the specific patch release and deployment instructions.; priority: High Workaround (Interim): Restrict local user access to systems running affected builds; limit multi-user access where possible. Review and restrict folder permissions on Acronis Cyber Protect installation directories using Windows NTFS ACL tools (icacls, Permissions UI) to ensure only SYSTEM and Administrators have write access to application binaries and configuration directories.; priority: Medium Mitigation: Apply principle of least privilege: run Acronis services with minimal required privileges; disable multi-user login on sensitive systems if Acronis is critical infrastructure. Monitor for suspicious file modifications in Acronis installation directories using Windows File Integrity Monitoring (e.g., Autoruns, Event Viewer auditing).; priority: Medium
Windows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
Windows Win32k contains an out-of-bounds write vulnerability enabling local privilege escalation to SYSTEM, exploited by
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Same technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today